Recently, I signed up on this website. As soon as I registered, they sent me an activation email.
After seeing the activation email, I was a little disturbed. The activation email consisted of the following info:
- Activation URL
- Username
- Password
Yes, they explicitly mentioned my password in the activation email.
This is very bad practice because of the following reasons:
- If I have made a typo in my email then the person who receives the email gets to know my really sensitive info.
- Even if typo is not there, but let's say, somehow someone manages to get access to my email, he will also now get access to my information on this new website where I registered.
Moreover, to the best of my knowledge, user sign-up forms are designed such that the party offering the service doesn't themselves get access to my password (this is usually done by first encrypting the password - one way hashing - and then storing it). But since they sent my password back again to my email, so it is possible that they indeed have access to my actual password.
I have submitted a query to them regarding this issue but I am not sure if some action will be taken soon or not.
So, I would like to know, in case they don't take any action at all, where can I submit my complaint regarding this?
Besides, I am not very confident if I can actually register a complaint because there terms and conditions page doesn't talk about anything related to this. And also, they never asked me if I agree to those terms and conditions.